Description
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Blair2004 NexoPOS
Default version status: unaffected
0 to ≤ 6.2.4affected
pkg:github/Blair2004/NexoPOSReferences
- https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure ↗
- https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18 ↗
- https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152 ↗
- https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint ↗